Deactivating evasive malware

ABSTRACT

A computer-implemented method, a computer program product, and a computer system. The computer system installs and configures a virtual imitating resource in the computer system, wherein the virtual imitating resource imitates a set of resources in the computer system. Installing and configuring the virtual imitating resource includes modifying respective values of an installed version of the virtual imitating resource for an environment of the computer system, determining whether the virtual imitating resource is a static imitating resource or a dynamic imitating resource, and comparing a call graph of the evasive malware with patterns of dynamic imitating resources on a database. The computer system returns a response from an appropriate element of the virtual imitating resource, in response to a call from the evasive malware to a real computing resource, return, by the computer system.

BACKGROUND

The present invention relates generally to computer security, and moreparticularly to deactivating evasive malware.

Security experts rely on analysis environments (such as malware analysissandboxes) to uncover malware behaviors and generate correspondingsignatures for future detection. However, most emerging malware isequipped with evasive logic to determine current execution environments.Once malware finds itself running within an analysis environment, themalware may choose not to execute and expose its malicious logic. Basedon a recent study, over 80% of malware exhibits evasive behaviors in thesecond half of 2015. There is extensive prior work on detectinguser-level sandboxes, system-level virtual machines, and hardware-leveldebugging extensions. Advanced evasive malware can fingerprint theseanalysis environments and cloak its malicious behaviors. Without the labanalysis results (i.e., malware signatures), it will be extremelydifficult to detect such malware running on physical end hosts.

SUMMARY

In one aspect, a computer-implemented method for protecting a host fromevasive malware is provided. The computer-implemented method includesinstalling and configuring, by a computer system, a virtual imitatingresource in the computer system, wherein the virtual imitating resourceimitates a set of resources in the computer system. Installing andconfiguring the virtual imitating resource includes modifying respectivevalues of an installed version of the virtual imitating resource for anenvironment of the computer system and determining whether the virtualimitating resource is a static imitating resource or a dynamic imitatingresource. Installing and configuring the virtual imitating resourcefurther includes, in response to determining that the virtual imitatingresource is the dynamic imitating resource, comparing a call graph ofthe evasive malware with patterns of dynamic imitating resources on adatabase. The computer-implemented method further includes returning, bythe computer system, a response from an appropriate element of thevirtual imitating resource, in response to a call from the evasivemalware to a real computing resource.

In another aspect, a computer program product for protecting a host fromevasive malware is provided. The computer program product comprising oneor more computer-readable tangible storage devices and programinstructions stored on at least one of the one or more computer-readabletangible storage devices. The program instructions are executable to:install and configure, by a computer system, a virtual imitatingresource in the computer system, wherein the virtual imitating resourceimitating a set of resources in the computer system; return, by thecomputer system, a response from an appropriate element of the virtualimitating resource, in response to a call from the evasive malware to areal computing resource. Installing and configuring the virtualimitating resource includes: modifying respective values of an installedversion of the virtual imitating resource for an environment of thecomputer system; determining whether the virtual imitating resource is astatic imitating resource or a dynamic imitating resource; and comparinga call graph of the evasive malware with patterns of dynamic imitatingresources on a database, in response to determining that the virtualimitating resource is the dynamic imitating resource.

In yet another aspect, a computer system for protecting a host fromevasive malware is provided. The computer system comprises one or moreprocessors, one or more computer readable tangible storage devices, andprogram instructions stored on at least one of the one or more computerreadable tangible storage devices for execution by at least one of theone or more processors. The program instructions are executable toinstall and configure, by a computer system, a virtual imitatingresource in the computer system, wherein the virtual imitating resourceimitating a set of resources in the computer system. Installing andconfiguring the virtual imitating resource includes modifying respectivevalues of an installed version of the virtual imitating resource for anenvironment of the computer system and determining whether the virtualimitating resource is a static imitating resource or a dynamic imitatingresource. Installing and configuring the virtual imitating resourcefurther includes, in response to determining that the virtual imitatingresource is the dynamic imitating resource, comparing a call graph ofthe evasive malware with patterns of dynamic imitating resources on adatabase. The program instructions are further executable to return, bythe computer system, a response from an appropriate element of thevirtual imitating resource, in response to a call from the evasivemalware to a real computing resource.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

FIG. 1 is a diagram illustrating an abstract model of evasive malware.

FIG. 2A and FIG. 2B are diagrams illustrating a real system view vs asystem view from an untrusted process (or malware), in accordance withone embodiment of the present invention.

FIG. 3 is a diagram illustrating a scarecrow architecture in anapplication layer, in accordance with one embodiment of the presentinvention.

FIG. 4 is a diagram illustrating a scarecrow architecture in anoperating system layer, in accordance with one embodiment of the presentinvention.

FIG. 5 is a diagram illustrating a scarecrow architecture in a hardwarelayer, in accordance with one embodiment of the present invention.

FIG. 6 is a flowchart showing operational steps for generating scarecrowresources deactivating evasive malware, in accordance with oneembodiment of the present invention.

FIG. 7A and FIG. 7B include a flowchart showing operational steps forprotecting a physical host from evasive malware, in accordance with oneembodiment of the present invention.

FIG. 8 is a diagram illustrating components of a computer device forgenerating scarecrow resources deactivating evasive malware or acomputer device protected by scarecrow resources, in accordance with oneembodiment of the present invention.

DETAILED DESCRIPTION

FIG. 1 is a diagram illustrating an abstract model of evasive malware.Before evasive malware executes its malicious behaviors, the evasivemalware checks whether it is running on analysis environments (as shownby block 101 in FIG. 1). In response to determining that the evasivemalware is running on analysis environments (TRUE path), the evasivemalware performs its benign behaviors (as shown by block 102 in FIG. 1).In response to determining that the evasive malware is not running onanalysis environments (FALSE path), the evasive malware performs itsmalicious behaviors (as shown by block 103 in FIG. 1). The presentinvention uses the characteristic of the evasive malware to trick theevasive malware such that the evasive malware always executes the TRUEpath shown in FIG. 1.

Embodiments of the present invention leverages the evasive nature ofmalware to protect computer systems from infection. Embodiments of thepresent invention disclose an approach to deactivating such malware onphysical hosts (computer devices). This approach takes advantage of theevasive nature of malware, which is different from a traditionalapproach in which developers try to improve sandbox techniques formalware analysis to extract more malware behaviors. As a result ofapplying the approach, malware will stop executing its maliciousbehaviors on physical hosts. This approach can be deployed in physicalhosts directly to provide a new way for system protection againstevasive malware. The approach of the present invention is similar tousing a scarecrow in open field to discourage birds from feeding ongrowing crops. Embodiments of the present invention disclose a method ofplace characteristics and features in a computer system such thatcharacteristics and features deceive malware into inferring a runningenvironment is an analysis environment and thereby will trigger themalware to disable itself.

Embodiments of the present invention discloses a method of inducinganalysis environment related resources which are usually not used bybenign software. In the method, counterfeit or imitating resourcesrelated to analysis environment fingerprinting are provided. Thequantity of the resources is limited but they can be used across malwarefamilies.

Embodiments of the present invention disclose a multi-layer system todeceive evasive malware into believing that a physical machine it isrunning on is an analysis environment, thus the malware will not conductmalicious activities to avoid being analyzed. However, it is notnecessary for benign software to show different behaviors on theanalysis environment and the physical machine.

Major contributions of the present invention are as follows. (1) Theapproach of the present invention deactivates evasive malware thatcannot be analyzed by the state-of-the-art analysis engines, so that theapproach of the present invention is complementary to existing analysisengines. (2) The approach of the present invention proactively stopsmalware before malware exposing malicious behaviors. (3) The approach ofthe present invention exploits evasive techniques to defend againstmalware. Since the evasive techniques are limited across differentmalware families, the approach of the present invention can defendagainst previously unknown malware.

FIG. 2A and FIG. 2B are diagrams illustrating a real system view versusa system view from untrusted process (or malware) 211, in accordancewith one embodiment of the present invention. FIG. 2A is a diagramillustrating the real system view. The real system view includesapplication layer 210, operating system layer 220, and hardware layer230. Application layer 210 includes application resources 212 through216. Application layer 210 also includes untrusted process (or malware)211. Operating system layer 220 includes operating resources 221 through223. Hardware layer 230 includes hardware resources 231 through 233.

FIG. 2B is a diagram illustrating a system view from untrusted process(or malware) 211. There are two ways to build scarecrow applicationresources (or imitating application resources) in application layer 210:(1) adding one or more real resources and (2) providing one or morevictual resources or decorated resources. With a decorated resource, avalue of an existing resource is modified.

Referring to FIG. 2B, in application layer 210, scarecrow applicationresource 218 is added as a real scarecrow application resource; forexample, application resource 218 is a scarecrow application resource(or imitating application resource) which can start a fake or imitatinganalysis process debug_process.exe in application layer 210 on aphysical host (or computer device) to deceive untrusted process (ormalware) 211 into believing that a sandbox analysis process is running.Application resource 218 causes untrusted process (or malware) 211 torespond to the imitating environment of the malware analysis as to areal environment of the malware analysis. Untrusted process (or malware)211 determines that it is running on analysis environments and thusperforms its benign behaviors or exits. In application layer 210,scarecrow application resource 217 is provided as a virtual applicationresource or decorated application resource. The operating system of thephysical host intercepts system calls related to application resource213 (shown in FIG. 2A) and returns crafted results (i.e., scarecrowapplication resource 217) to untrusted process (or malware) 211. Forexample, when untrusted process (or malware) 211 use Process32next( ) toenumerate current running processes, the operating system intercepts thesystem call and returns faked or imitated process list (e.g.,debug_process.exe). FIG. 3 is a diagram illustrating a scarecrowarchitecture in application layer 210, in accordance with one embodimentof the present invention. Application layer 210 includes real process311, directly added scarecrow process 312, and virtual scarecrow process313. Directly added scarecrow process 312 deceives untrusted process (ormalware) 211 into believing that a sandbox analysis process is running.Operating system layer 220 intercepts a system call from untrustedprocess (or malware) 211 and returns a faked or imitated process—virtualscarecrow process 313—back to untrusted process (or malware) 211.

Referring to FIG. 2B, in operating system layer 220, scarecrow operatingsystem resource 225 is added as a real scarecrow operating resource. Forexample, a fake or imitating driver VBoxMouse.sys, which is an indicatorof a VirtualBox® environment, is directly created in operating systemlayer 220; the fake or imitating driver deceives untrusted process (ormalware) 211 into believing that a sandbox analysis process is running.Scarecrow operating system resource 225 causes untrusted process (ormalware) 211 to respond to the imitating environment of the malwareanalysis as to a real environment of the malware analysis. Untrustedprocess (or malware) 211 determines that it is running on analysisenvironments and thus performs its benign behaviors or exits. Inoperating system layer 220, scarecrow operating system resource 224 isprovided as a virtual operating resource or a decorated operatingresource. A call from untrusted process (or malware) 211 to operatingresource 223 (Shown in FIG. 2A) (which is, for example, related to asystem API) is intercepted by the operating system and the operatingsystem returns crafted results (i.e., scarecrow operating systemresource 224) to untrusted process (or malware) 211. FIG. 4 is a diagramillustrating a scarecrow architecture in operating system layer 220, inaccordance with one embodiment of the present invention. Operatingsystem layer 220 includes real operating system resource 413, directlyadded scarecrow operating system resource 412, and virtual scarecrowoperating system resource 411. Directly added scarecrow operating systemresource 412 deceive untrusted process (or malware) 211 into believingthat a sandbox analysis process is running. Operating system layer 220intercepts a system call from untrusted process (or malware) 211 andreturns a faked or imitated process—virtual scarecrow operating systemresource 411—back to untrusted process (or malware) 211.

Referring to FIG. 2B, in hardware layer 230, kernel data that representshardware resources to the user is modified, instead of directly addingreal scarecrow hardware recourses. In hardware layer 230, virtualscarecrow hardware resources or decorated hardware resources areprovided. In hardware layer 230, virtual scarecrow hardware resources235 is also provided. Also, virtual scarecrow hardware resources 234 isprovided; when untrusted process (or malware) 211 calls hardwareresource 231 (shown in FIG. 2A), operating system layer 220 intercepts acorresponding system API and returns crafted results (i.e., scarecrowhardware resource 234 or scarecrow hardware resource 235) to untrustedprocess (or malware) 211. For example, when untrusted process (ormalware) 211 checks whether a camera is installed on the physical hostthrough a system call, operating system layer 220 intercepts the callsand return true to untrusted process (or malware) 211. As a result,untrusted process (or malware) 211 believes the camera is installed butactually no camera is installed on the physical host. FIG. 5 is adiagram illustrating a scarecrow architecture in hardware layer 230, inaccordance with one embodiment of the present invention. Hardware layer230 includes real hardware resource 521 and virtual scarecrow hardwareresource 522. Operating system layer 230 intercepts a system call fromuntrusted process (or malware) 211 and returns a faked or imitatedprocess—virtual scarecrow hardware resource 522—back to untrustedprocess (or malware) 211.

FIG. 6 is a flowchart showing operational steps for generating scarecrowresources deactivating evasive malware, in accordance with oneembodiment of the present invention. The generating scarecrow resourcesdeactivating evasive malware is implemented by a computer device orserver. The computer device will be described in detail in laterparagraphs of this document, with reference to FIG. 8. At step 601, thecomputer device or server generates scarecrow resources (or imitatingresources) based on public reports of malware analysis. The scarecrowresources (or imitating resources) generated at step 601 include but notlimited to folders, files, libraries, and registry entries. At step 602,the computer device or server generates scarecrow resources (orimitating resources) by differential analysis of different malwareanalysis environments. The scarecrow resources (or imitating resources)generated at step 602 include but not limited to system calls, APIs, andrelationships of the calls. At step 603, the computer device or serverpreprocesses the scarecrow resources (or imitating resources) generatedat step 601 and/or step 602. Preprocessing the scarecrow resources (orimitating resources) includes filtering duplicated resources, filteringresources with conflicts, and generating dependent relations of theresources. At step 604, the computer device or server stores in adatabase the scarecrow resources (or imitating resources) generated atstep 601 and/or step 602. The database is used for deactivating evasivemalware by scarecrow resources (or imitating resources) on a physicalhost, which will be discussed in later paragraphs of this document, withreference to FIG. 7.

The scarecrow resources (or imitating resources) generated at step 601are static scarecrow resources whose values are deterministic (e.g.,processes and files). Therefore, the scarecrow resources (or imitatingresources) generated at step 601 are directly created or installed onphysical hosts.

The scarecrow resources (or imitating resources) generated at step 602are dynamic scarecrow resources whose values are dynamically changed inan operating system of a physical host. Therefore, the operating systemintercepts the system calls or related APIs and returns virtualresources—the scarecrow resources (or imitating resources) generated atstep 602.

FIG. 7A and FIG. 7B include a flowchart showing operational steps forprotecting a physical host from evasive malware, in accordance with oneembodiment of the present invention. The steps 701-713 in FIG. 7A andFIG. 7B are implemented by a physical host which is a computer device tobe protected by scarecrow resources (or imitating resources. Thephysical host will be described in detail in later paragraphs of thisdocument, with reference to FIG. 8. At step 701, the physical hostdetermines whether all scarecrow resources (or imitating resources) areinstalled on the physical host. In response to determining that allscarecrow resources (or imitating resources) are installed on thephysical host (YES branch of step 701), the operational steps areterminated. In response to determining that no all scarecrow resources(or imitating resources) are installed on the physical host (NO branchof step 701), step 702 is executed. At step 702, the physical hostretrieves from a database a respective one of the scarecrow resources(or imitating resources). The scarecrow resources (or imitatingresources), which are generated at step 601 and/or step 602 shown inFIG. 6, are stored in the database. At step 703, the physical hostdetermines whether the respective one of the scarecrow resources is astatic scarecrow resource or a dynamic scarecrow resource.

In response to determining that the respective one of the scarecrowresources is a static scarecrow resource, the physical host at step 704further determines whether the static scarecrow resource exists in thephysical host. In response to determining that the static scarecrowresource does not exist in the physical host (NO branch of step 704),the physical host at step 705 installs the static scarecrow resource onthe physical host. After step 705, the physical host reiterates step701.

In response to determining that the static scarecrow resource exists onthe physical host (YES branch of step 704), the physical host reiteratesstep 701.

In response to determining that the respective one of the scarecrowresources is a dynamic scarecrow resource, the physical host executessteps presented in FIG. 7B, as indicated by—in FIG. 7A and FIG. 7B. Atstep 706 (shown in FIG. 7B), the operating system of the physical hostintercepts a system call by malware or an untrusted resource to aresource on the physical host. At step 707, the physical host updates acall graph on a database storing call graphs. The call graph database isa recording of the current running malware call behaviors. At step 708,the physical host determines whether a status of the system call matchespatterns of dynamic scarecrow resources. The dynamic scarecrow resourcesare stored in a database. In one embodiment, both the dynamic scarecrowresources (dynamic imitating resources) and the static scarecrowresources (static imitating resources) are stored on the same database.In another embodiment, the dynamic scarecrow resources (dynamicimitating resources) are stored on one database while the staticscarecrow resources (static imitating resources) are stored on anotherdatabase. In response to determining that the status of the system calldoes not match patterns of dynamic scarecrow resources (NO branch ofstep 708), the physical host reiterates step 706.

In response to determining that the status of the system call matchespatterns of dynamic scarecrow resources (YES branch of step 708), thephysical host at step 709 determines whether to modify values in memory.In response to determining to modify the values in the memory (YESbranch of step 709), the physical host at step 710 modifies the valuesin the memory.

In response to determining not to modify the values in the memory (NObranch of step 709), the physical host at step 710 determines whether toreturn a virtual value to the malware or the untrusted resource. Inresponse to determining to return the virtual value to the malware orthe untrusted resource (YES branch of step 711), the physical host atstep 712 returns the virtual value to the malware or the untrustedresource. After step 712, the physical host reiterates step 706. Inresponse to determining not to return the virtual value to the malwareor the untrusted resource (NO branch of step 711), the physical hostreiterates step 706.

FIG. 8 is a diagram illustrating components of computer device 800 forgenerating for generating scarecrow resources deactivating evasivemalware or computer device 800 protected by scarecrow resources, inaccordance with one embodiment of the present invention. It should beappreciated that FIG. 8 provides only an illustration of oneimplementation and does not imply any limitations with regard to theenvironment in which different embodiments may be implemented. Thecomputer device may be any electronic device or computing system capableof receiving input from a user, executing computer program instructions,and communicating with another electronic device or computing system viaa network.

Referring to FIG. 8, device 800 includes processor(s) 820, memory 810,and tangible storage device(s) 830. In FIG. 8, communications among theabove-mentioned components of device 800 are denoted by numeral 890.Memory 810 includes ROM(s) (Read Only Memory) 811, RAM(s) (Random AccessMemory) 813, and cache(s) 815. One or more operating systems 831 and oneor more computer programs 833 reside on one or more computer readabletangible storage device(s) 830. On a computer device for generatingscarecrow resources deactivating evasive malware, one or more computerprograms 833 include one or more program for generating scarecrowresources. On a computer device to be protected by scarecrow resources,one or more computer programs 833 include one or more program forprotecting the physical host by scarecrow resources from evasivemalware. Device 800 further includes I/O interface(s) 850. I/Ointerface(s) 850 allows for input and output of data with externaldevice(s) 860 that may be connected to device 800. Device 800 furtherincludes network interface(s) 840 for communications between device 800and a computer network.

The present invention may be a system, a method, and/or a computerprogram product. The computer program product may include a computerreadable storage medium (or media) having computer readable programinstructions thereon for causing a processor to carry out aspects of thepresent invention.

The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device, such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network(LAN), a wide area network (WAN), and/or a wireless network. The networkmay comprise copper transmission cables, optical transmission fibers,wireless transmission, routers, firewalls, switches, gateway computersand/or edge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, or either source code or object code written in anycombination of one or more programming languages, including an objectoriented programming language such as Smalltalk, C++, and conventionalprocedural programming languages, such as the C programming language, orsimilar programming languages. The computer readable programinstructions may execute entirely on the user's computer, partly on theuser's computer, as a stand-alone software package, partly on the user'scomputer and partly on a remote computer, or entirely on the remotecomputer or server. In the latter scenario, the remote computer may beconnected to the user's computer through any type of network, includinga local area network (LAN) or a wide area network (WAN), or theconnection may be made to an external computer (for example, through theInternet using an Internet Service Provider). In some embodiments,electronic circuitry including, for example, programmable logiccircuitry, field-programmable gate arrays (FPGA), or programmable logicarrays (PLA) may execute the computer readable program instructions byutilizing state information of the computer readable programinstructions to personalize the electronic circuitry in order to performaspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture, including instructions which implement aspectsof the function/act specified in the flowchart and/or block diagramblock or blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus, or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the block may occur out of theorder noted in the figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

What is claimed is:
 1. A computer-implemented method for protecting ahost from evasive malware, the computer-implemented method comprising:installing and configuring, by a computer system, a virtual imitatingresource in the computer system, the virtual imitating resourceimitating a set of resources in the computer system, wherein installingand configuring the virtual imitating resource includes modifyingrespective values of an installed version of the virtual imitatingresource for an environment of the computer system, wherein installingand configuring the virtual imitating resource further includesdetermining whether the virtual imitating resource is a static imitatingresource or a dynamic imitating resource, wherein installing andconfiguring the virtual imitating resource further includes, in responseto determining that the virtual imitating resource is the dynamicimitating resource, comparing a call graph of the evasive malware withpatterns of dynamic imitating resources on a database; in response to acall from the evasive malware to a real computing resource, returning,by the computer system, a response from an appropriate element of thevirtual imitating resource.
 2. The computer-implemented method of claim1, further comprising: installing, by the computer system, the virtualimitating resource in an application layer of the computer system toimitate a real application resource in the application layer.
 3. Thecomputer-implemented method of claim 1, further comprising: installing,by the computer system, the virtual imitating resource in an operatingsystem layer of the computer system to imitate a real operating systemresource in the operating system layer.
 4. The computer-implementedmethod of claim 1, further comprising: installing, by the computersystem, the virtual imitating resource in a hardware layer of thecomputer system to imitate a real hardware resource in the hardwarelayer.
 5. The computer-implemented method of claim 1, wherein thevirtual imitating resource is generated by a server, based on publicreports of malware analysis, wherein the virtual imitating resource isstored by the server in a database storing imitating resources.
 6. Thecomputer-implemented method of claim 5, wherein the virtual imitatingresource is retrieved by the computer system from the database storingimitating resources.
 7. The computer-implemented method of claim 1,wherein the virtual imitating resource is one of static resources whosevalues are deterministic, wherein the static resources are at least oneof processes and files.
 8. A computer program product for protecting ahost from evasive malware, the computer program product comprising oneor more computer-readable tangible storage devices and programinstructions stored on at least one of the one or more computer-readabletangible storage devices, the program instructions executable to:install and configure, by a computer system, a virtual imitatingresource in the computer system, the virtual imitating resourceimitating a set of resources in the computer system, wherein installingand configuring the virtual imitating resource includes modifyingrespective values of an installed version of the virtual imitatingresource for an environment of the computer system, wherein installingand configuring the virtual imitating resource further includesdetermining whether the virtual imitating resource is a static imitatingresource or a dynamic imitating resource, wherein installing andconfiguring the virtual imitating resource further includes, in responseto determining that the virtual imitating resource is the dynamicimitating resource, comparing a call graph of the evasive malware withpatterns of dynamic imitating resources on a database; in response to acall from the evasive malware to a real computing resource, return, bythe computer system, a response from an appropriate element of thevirtual imitating resource.
 9. The computer program product of claim 8,further comprising the program instructions executable to: install, bythe computer system, the virtual imitating resource in an applicationlayer of the computer system to imitate a real application resource inthe application layer.
 10. The computer program product of claim 8,further comprising the program instructions executable to: install, bythe computer system, the virtual imitating resource in an operatingsystem layer of the computer system to imitate a real operating systemresource in the operating system layer.
 11. The computer program productof claim 8, further comprising the program instructions executable to:install, by the computer system, the virtual imitating resource in ahardware layer of the computer system to imitate a real hardwareresource in the hardware layer.
 12. The computer program product ofclaim 8, wherein the virtual imitating resource is generated by aserver, based on public reports of malware analysis, wherein the virtualimitating resource is stored by the server in a database storingimitating resources.
 13. The computer program product of claim 12,wherein the virtual imitating resource is retrieved by the computersystem from the database storing imitating resources.
 14. The computerprogram product of claim 8, wherein the virtual imitating resource isone of static resources whose values are deterministic, wherein thestatic resources are at least one of processes and files.
 15. A computersystem for deactivating evasive malware, the computer system comprising:one or more processors, one or more computer readable tangible storagedevices, and program instructions stored on at least one of the one ormore computer readable tangible storage devices for execution by atleast one of the one or more processors, the program instructionsexecutable to: install and configure, by the computer system, a virtualimitating resource in the computer system, the virtual imitatingresource imitating a set of resources in the computer system, whereininstalling and configuring the virtual imitating resource includesmodifying respective values of an installed version of the virtualimitating resource for an environment of the computer system, whereininstalling and configuring the virtual imitating resource furtherincludes determining whether the virtual imitating resource is a staticimitating resource or a dynamic imitating resource, wherein installingand configuring the virtual imitating resource further includes, inresponse to determining that the virtual imitating resource is thedynamic imitating resource, comparing a call graph of the evasivemalware with patterns of dynamic imitating resources on a database; inresponse to a call from the evasive malware to a real computingresource, return, by the computer system, a response from an appropriateelement of the virtual imitating resource.
 16. The computer system ofclaim 15, further comprising the program instructions executable to:install, by the computer system, the virtual imitating resource in anapplication layer of the computer system to imitate a real applicationresource in the application layer.
 17. The computer system of claim 15,further comprising the program instructions executable to: install, bythe computer system, the virtual imitating resource in an operatingsystem layer of the computer system to imitate a real operating systemresource in the operating system layer.
 18. The computer system of claim15, further comprising the program instructions executable to: install,by the computer system, the virtual imitating resource in a hardwarelayer of the computer system to imitate a real hardware resource in thehardware layer.
 19. The computer system of claim 15, wherein the virtualimitating resource is generated by a server, based on public reports ofmalware analysis, wherein the virtual imitating resource is stored bythe server in a database storing imitating resources, wherein thevirtual imitating resource is retrieved by the computer system from thedatabase storing imitating resources.
 20. The computer system of claim15, wherein the virtual imitating resource is one of static resourceswhose values are deterministic, wherein the static resources are atleast one of processes and files.